git.iko.soy/typeable/oauth2-proxy
on ea261ca help sign in
typeable/oauth2-proxy/pkg/http/server_test.go
472 lines 14 kB history raw
1package http
3import (
4 "context"
5 "errors"
6 "fmt"
7 "io/ioutil"
8 "net/http"
10 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"
11 . "github.com/onsi/ginkgo"
12 . "github.com/onsi/ginkgo/extensions/table"
13 . "github.com/onsi/gomega"
16const hello = "Hello World!"
18var _ = Describe("Server", func() {
19 handler := http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
20 rw.Write([]byte(hello))
21 })
23 Context("NewServer", func() {
24 type newServerTableInput struct {
25 opts Opts
26 expectedErr error
27 expectHTTPListener bool
28 expectTLSListener bool
29 }
31 DescribeTable("When creating the new server from the options", func(in *newServerTableInput) {
32 srv, err := NewServer(in.opts)
33 if in.expectedErr != nil {
34 Expect(err).To(MatchError(ContainSubstring(in.expectedErr.Error())))
35 Expect(srv).To(BeNil())
36 return
37 }
39 Expect(err).ToNot(HaveOccurred())
41 s, ok := srv.(*server)
42 Expect(ok).To(BeTrue())
44 Expect(s.listener != nil).To(Equal(in.expectHTTPListener))
45 if in.expectHTTPListener {
46 Expect(s.listener.Close()).To(Succeed())
47 }
48 Expect(s.tlsListener != nil).To(Equal(in.expectTLSListener))
49 if in.expectTLSListener {
50 Expect(s.tlsListener.Close()).To(Succeed())
51 }
52 },
53 Entry("with a valid http bind address", &newServerTableInput{
54 opts: Opts{
55 Handler: handler,
56 BindAddress: "127.0.0.1:0",
57 },
58 expectedErr: nil,
59 expectHTTPListener: true,
60 expectTLSListener: false,
61 }),
62 Entry("with a valid https bind address, with no TLS config", &newServerTableInput{
63 opts: Opts{
64 Handler: handler,
65 SecureBindAddress: "127.0.0.1:0",
66 },
67 expectedErr: errors.New("error setting up TLS listener: no TLS config provided"),
68 expectHTTPListener: false,
69 expectTLSListener: false,
70 }),
71 Entry("with a valid https bind address, and valid TLS config", &newServerTableInput{
72 opts: Opts{
73 Handler: handler,
74 SecureBindAddress: "127.0.0.1:0",
75 TLS: &options.TLS{
76 Key: &keyDataSource,
77 Cert: &certDataSource,
78 },
79 },
80 expectedErr: nil,
81 expectHTTPListener: false,
82 expectTLSListener: true,
83 }),
84 Entry("with a both a valid http and valid https bind address, and valid TLS config", &newServerTableInput{
85 opts: Opts{
86 Handler: handler,
87 BindAddress: "127.0.0.1:0",
88 SecureBindAddress: "127.0.0.1:0",
89 TLS: &options.TLS{
90 Key: &keyDataSource,
91 Cert: &certDataSource,
92 },
93 },
94 expectedErr: nil,
95 expectHTTPListener: true,
96 expectTLSListener: true,
97 }),
98 Entry("with a \"-\" for the bind address", &newServerTableInput{
99 opts: Opts{
100 Handler: handler,
101 BindAddress: "-",
102 },
103 expectedErr: nil,
104 expectHTTPListener: false,
105 expectTLSListener: false,
106 }),
107 Entry("with a \"-\" for the secure bind address", &newServerTableInput{
108 opts: Opts{
109 Handler: handler,
110 SecureBindAddress: "-",
111 },
112 expectedErr: nil,
113 expectHTTPListener: false,
114 expectTLSListener: false,
115 }),
116 Entry("with an invalid bind address scheme", &newServerTableInput{
117 opts: Opts{
118 Handler: handler,
119 BindAddress: "invalid://127.0.0.1:0",
120 },
121 expectedErr: errors.New("error setting up listener: listen (invalid, 127.0.0.1:0) failed: listen invalid: unknown network invalid"),
122 expectHTTPListener: false,
123 expectTLSListener: false,
124 }),
125 Entry("with an invalid secure bind address scheme", &newServerTableInput{
126 opts: Opts{
127 Handler: handler,
128 SecureBindAddress: "invalid://127.0.0.1:0",
129 TLS: &options.TLS{
130 Key: &keyDataSource,
131 Cert: &certDataSource,
132 },
133 },
134 expectedErr: nil,
135 expectHTTPListener: false,
136 expectTLSListener: true,
137 }),
138 Entry("with an invalid bind address port", &newServerTableInput{
139 opts: Opts{
140 Handler: handler,
141 BindAddress: "127.0.0.1:a",
142 },
143 expectedErr: errors.New("error setting up listener: listen (tcp, 127.0.0.1:a) failed: listen tcp: "),
144 expectHTTPListener: false,
145 expectTLSListener: false,
146 }),
147 Entry("with an invalid secure bind address port", &newServerTableInput{
148 opts: Opts{
149 Handler: handler,
150 SecureBindAddress: "127.0.0.1:a",
151 TLS: &options.TLS{
152 Key: &keyDataSource,
153 Cert: &certDataSource,
154 },
155 },
156 expectedErr: errors.New("error setting up TLS listener: listen (127.0.0.1:a) failed: listen tcp: "),
157 expectHTTPListener: false,
158 expectTLSListener: false,
159 }),
160 Entry("with an invalid TLS key", &newServerTableInput{
161 opts: Opts{
162 Handler: handler,
163 SecureBindAddress: "127.0.0.1:0",
164 TLS: &options.TLS{
165 Key: &options.SecretSource{
166 Value: []byte("invalid"),
167 },
168 Cert: &certDataSource,
169 },
170 },
171 expectedErr: errors.New("error setting up TLS listener: could not load certificate: could not parse certificate data: tls: failed to find any PEM data in key input"),
172 expectHTTPListener: false,
173 expectTLSListener: false,
174 }),
175 Entry("with an invalid TLS cert", &newServerTableInput{
176 opts: Opts{
177 Handler: handler,
178 SecureBindAddress: "127.0.0.1:0",
179 TLS: &options.TLS{
180 Key: &keyDataSource,
181 Cert: &options.SecretSource{
182 Value: []byte("invalid"),
183 },
184 },
185 },
186 expectedErr: errors.New("error setting up TLS listener: could not load certificate: could not parse certificate data: tls: failed to find any PEM data in certificate input"),
187 expectHTTPListener: false,
188 expectTLSListener: false,
189 }),
190 Entry("with no TLS key", &newServerTableInput{
191 opts: Opts{
192 Handler: handler,
193 SecureBindAddress: "127.0.0.1:0",
194 TLS: &options.TLS{
195 Cert: &certDataSource,
196 },
197 },
198 expectedErr: errors.New("error setting up TLS listener: could not load certificate: could not load key data: no configuration provided"),
199 expectHTTPListener: false,
200 expectTLSListener: false,
201 }),
202 Entry("with no TLS cert", &newServerTableInput{
203 opts: Opts{
204 Handler: handler,
205 SecureBindAddress: "127.0.0.1:0",
206 TLS: &options.TLS{
207 Key: &keyDataSource,
208 },
209 },
210 expectedErr: errors.New("error setting up TLS listener: could not load certificate: could not load cert data: no configuration provided"),
211 expectHTTPListener: false,
212 expectTLSListener: false,
213 }),
214 Entry("when the bind address is prefixed with the http scheme", &newServerTableInput{
215 opts: Opts{
216 Handler: handler,
217 BindAddress: "http://127.0.0.1:0",
218 },
219 expectedErr: nil,
220 expectHTTPListener: true,
221 expectTLSListener: false,
222 }),
223 Entry("when the secure bind address is prefixed with the https scheme", &newServerTableInput{
224 opts: Opts{
225 Handler: handler,
226 SecureBindAddress: "https://127.0.0.1:0",
227 TLS: &options.TLS{
228 Key: &keyDataSource,
229 Cert: &certDataSource,
230 },
231 },
232 expectedErr: nil,
233 expectHTTPListener: false,
234 expectTLSListener: true,
235 }),
236 )
237 })
239 Context("Start", func() {
240 var srv Server
241 var ctx context.Context
242 var cancel context.CancelFunc
244 BeforeEach(func() {
245 ctx, cancel = context.WithCancel(context.Background())
246 })
248 AfterEach(func() {
249 cancel()
250 })
252 Context("with an http server", func() {
253 var listenAddr string
255 BeforeEach(func() {
256 var err error
257 srv, err = NewServer(Opts{
258 Handler: handler,
259 BindAddress: "127.0.0.1:0",
260 })
261 Expect(err).ToNot(HaveOccurred())
263 s, ok := srv.(*server)
264 Expect(ok).To(BeTrue())
266 listenAddr = fmt.Sprintf("http://%s/", s.listener.Addr().String())
267 })
269 It("Starts the server and serves the handler", func() {
270 go func() {
271 defer GinkgoRecover()
272 Expect(srv.Start(ctx)).To(Succeed())
273 }()
275 resp, err := client.Get(listenAddr)
276 Expect(err).ToNot(HaveOccurred())
277 Expect(resp.StatusCode).To(Equal(http.StatusOK))
279 body, err := ioutil.ReadAll(resp.Body)
280 Expect(err).ToNot(HaveOccurred())
281 Expect(string(body)).To(Equal(hello))
282 })
284 It("Stops the server when the context is cancelled", func() {
285 go func() {
286 defer GinkgoRecover()
287 Expect(srv.Start(ctx)).To(Succeed())
288 }()
290 _, err := client.Get(listenAddr)
291 Expect(err).ToNot(HaveOccurred())
293 cancel()
295 Eventually(func() error {
296 _, err := client.Get(listenAddr)
297 return err
298 }).Should(HaveOccurred())
299 })
300 })
302 Context("with an https server", func() {
303 var secureListenAddr string
305 BeforeEach(func() {
306 var err error
307 srv, err = NewServer(Opts{
308 Handler: handler,
309 SecureBindAddress: "127.0.0.1:0",
310 TLS: &options.TLS{
311 Key: &keyDataSource,
312 Cert: &certDataSource,
313 },
314 })
315 Expect(err).ToNot(HaveOccurred())
317 s, ok := srv.(*server)
318 Expect(ok).To(BeTrue())
320 secureListenAddr = fmt.Sprintf("https://%s/", s.tlsListener.Addr().String())
321 })
323 It("Starts the server and serves the handler", func() {
324 go func() {
325 defer GinkgoRecover()
326 Expect(srv.Start(ctx)).To(Succeed())
327 }()
329 resp, err := client.Get(secureListenAddr)
330 Expect(err).ToNot(HaveOccurred())
331 Expect(resp.StatusCode).To(Equal(http.StatusOK))
333 body, err := ioutil.ReadAll(resp.Body)
334 Expect(err).ToNot(HaveOccurred())
335 Expect(string(body)).To(Equal(hello))
336 })
338 It("Stops the server when the context is cancelled", func() {
339 go func() {
340 defer GinkgoRecover()
341 Expect(srv.Start(ctx)).To(Succeed())
342 }()
344 _, err := client.Get(secureListenAddr)
345 Expect(err).ToNot(HaveOccurred())
347 cancel()
349 Eventually(func() error {
350 _, err := client.Get(secureListenAddr)
351 return err
352 }).Should(HaveOccurred())
353 })
355 It("Serves the certificate provided", func() {
356 go func() {
357 defer GinkgoRecover()
358 Expect(srv.Start(ctx)).To(Succeed())
359 }()
361 resp, err := client.Get(secureListenAddr)
362 Expect(err).ToNot(HaveOccurred())
363 Expect(resp.StatusCode).To(Equal(http.StatusOK))
365 Expect(resp.TLS.VerifiedChains).Should(HaveLen(1))
366 Expect(resp.TLS.VerifiedChains[0]).Should(HaveLen(1))
367 Expect(resp.TLS.VerifiedChains[0][0].Raw).Should(Equal(certData))
368 })
369 })
371 Context("with both an http and an https server", func() {
372 var listenAddr, secureListenAddr string
374 BeforeEach(func() {
375 var err error
376 srv, err = NewServer(Opts{
377 Handler: handler,
378 BindAddress: "127.0.0.1:0",
379 SecureBindAddress: "127.0.0.1:0",
380 TLS: &options.TLS{
381 Key: &keyDataSource,
382 Cert: &certDataSource,
383 },
384 })
385 Expect(err).ToNot(HaveOccurred())
387 s, ok := srv.(*server)
388 Expect(ok).To(BeTrue())
390 listenAddr = fmt.Sprintf("http://%s/", s.listener.Addr().String())
391 secureListenAddr = fmt.Sprintf("https://%s/", s.tlsListener.Addr().String())
392 })
394 It("Starts the server and serves the handler on http", func() {
395 go func() {
396 defer GinkgoRecover()
397 Expect(srv.Start(ctx)).To(Succeed())
398 }()
400 resp, err := client.Get(listenAddr)
401 Expect(err).ToNot(HaveOccurred())
402 Expect(resp.StatusCode).To(Equal(http.StatusOK))
404 body, err := ioutil.ReadAll(resp.Body)
405 Expect(err).ToNot(HaveOccurred())
406 Expect(string(body)).To(Equal(hello))
407 })
409 It("Starts the server and serves the handler on https", func() {
410 go func() {
411 defer GinkgoRecover()
412 Expect(srv.Start(ctx)).To(Succeed())
413 }()
415 resp, err := client.Get(secureListenAddr)
416 Expect(err).ToNot(HaveOccurred())
417 Expect(resp.StatusCode).To(Equal(http.StatusOK))
419 body, err := ioutil.ReadAll(resp.Body)
420 Expect(err).ToNot(HaveOccurred())
421 Expect(string(body)).To(Equal(hello))
422 })
424 It("Stops both servers when the context is cancelled", func() {
425 go func() {
426 defer GinkgoRecover()
427 Expect(srv.Start(ctx)).To(Succeed())
428 }()
430 _, err := client.Get(listenAddr)
431 Expect(err).ToNot(HaveOccurred())
432 _, err = client.Get(secureListenAddr)
433 Expect(err).ToNot(HaveOccurred())
435 cancel()
437 Eventually(func() error {
438 _, err := client.Get(listenAddr)
439 return err
440 }).Should(HaveOccurred())
441 Eventually(func() error {
442 _, err := client.Get(secureListenAddr)
443 return err
444 }).Should(HaveOccurred())
445 })
446 })
447 })
449 Context("getNetworkScheme", func() {
450 DescribeTable("should return the scheme", func(in, expected string) {
451 Expect(getNetworkScheme(in)).To(Equal(expected))
452 },
453 Entry("with no scheme", "127.0.0.1:0", "tcp"),
454 Entry("with a tcp scheme", "tcp://127.0.0.1:0", "tcp"),
455 Entry("with a http scheme", "http://192.168.0.1:1", "tcp"),
456 Entry("with a unix scheme", "unix://172.168.16.2:2", "unix"),
457 Entry("with a random scheme", "random://10.10.10.10:10", "random"),
458 )
459 })
461 Context("getListenAddress", func() {
462 DescribeTable("should remove the scheme", func(in, expected string) {
463 Expect(getListenAddress(in)).To(Equal(expected))
464 },
465 Entry("with no scheme", "127.0.0.1:0", "127.0.0.1:0"),
466 Entry("with a tcp scheme", "tcp://127.0.0.1:0", "127.0.0.1:0"),
467 Entry("with a http scheme", "http://192.168.0.1:1", "192.168.0.1:1"),
468 Entry("with a unix scheme", "unix://172.168.16.2:2", "172.168.16.2:2"),
469 Entry("with a random scheme", "random://10.10.10.10:10", "10.10.10.10:10"),
470 )
471 })
472})